nst-viewer[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

nst-viewer.exe
Size

35.1MB
MD5

47de8054179116f8142a6063930a51f3
SHA1

0819d7d90becd5d96c4d01a8b28b1093e085e454
SHA256

49c349a6453cbdda896205f0fb48fad9e70c37055be701c06977df64e00602d5
SHA512

a077cc2be646e6bddf65a4bf54c05d0bc47b0939f855eda5e4c9203ad7e1e5e650d50519906f15204e04d0f1d5b7ae2c05c55326a26646d37d635ea81f4a58c6
SSDEEP

786432:hq83/8F6MX97YCC/2ZLPRCFHichtwBw5/sXYXBmK5xlZJtDBWAlYm93w:Y40M6NBCeNPRohtwBw5/sMBmKDbBWAlA

Score

1^/10

Malware Config

Signatures

Files

nst-viewer.exe
.exe windows x86

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19/09/2018, 00:00

Not After

28/01/2028, 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15/06/2016, 00:00

Not After

15/06/2024, 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

42:7e:49:a2:96:36:01:02:b9:3c:b0:a4
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2019, 05:18

Not After

14/06/2022, 05:18

Subject

SERIALNUMBER=U72900DL2018PTC336564,CN=KernelApps Private Limited,O=KernelApps Private Limited,STREET=B 57\, 2nd floor\, Sector 57,L=Noida,ST=Uttar Pradesh,C=IN,1.3.6.1.4.1.311.60.2.1.2=#130d55747461722050726164657368,1.3.6.1.4.1.311.60.2.1.3=#1302494e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Not Before

19/02/2018, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign TSA for Advanced - G2

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

04:00:00:00:00:01:31:89:c6:50:04
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

02/08/2011, 10:00

Not After

29/03/2029, 10:00

Subject

CN=GlobalSign Timestamping CA - SHA256 - G2,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

3e:be:f6:49:df:b2:3c:ff:63:d8:ef:30:92:b7:e5:43:35:10:d2:da
Signer

Actual PE Digest

3e:be:f6:49:df:b2:3c:ff:63:d8:ef:30:92:b7:e5:43:35:10:d2:da

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=U72900DL2018PTC336564,CN=KernelApps Private Limited,O=KernelApps Private Limited,STREET=B 57\, 2nd floor\, Sector 57,L=Noida,ST=Uttar Pradesh,C=IN,1.3.6.1.4.1.311.60.2.1.2=#130d55747461722050726164657368,1.3.6.1.4.1.311.60.2.1.3=#1302494e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

31/12/2020, 12:01
Valid: true

Chain 1

SERIALNUMBER=U72900DL2018PTC336564,CN=KernelApps Private Limited,O=KernelApps Private Limited,STREET=B 57\, 2nd floor\, Sector 57,L=Noida,ST=Uttar Pradesh,C=IN,1.3.6.1.4.1.311.60.2.1.2=#130d55747461722050726164657368,1.3.6.1.4.1.311.60.2.1.3=#1302494e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Chain 2

SERIALNUMBER=U72900DL2018PTC336564,CN=KernelApps Private Limited,O=KernelApps Private Limited,STREET=B 57\, 2nd floor\, Sector 57,L=Noida,ST=Uttar Pradesh,C=IN,1.3.6.1.4.1.311.60.2.1.2=#130d55747461722050726164657368,1.3.6.1.4.1.311.60.2.1.3=#1302494e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 1024B - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

42:7e:49:a2:96:36:01:02:b9:3c:b0:a4Certificate

Extended Key Usages

Key Usages

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3aCertificate

Extended Key Usages

Key Usages

04:00:00:00:00:01:31:89:c6:50:04Certificate

Key Usages

3e:be:f6:49:df:b2:3c:ff:63:d8:ef:30:92:b7:e5:43:35:10:d2:daSigner

Signature Validations

Verification

31/12/2020, 12:01 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Sections

CODE Size: 41KB - Virtual size: 40KB

DATA Size: 1024B - Virtual size: 592B

BSS Size: - Virtual size: 3KB

.idata Size: 2KB - Virtual size: 2KB

.tls Size: - Virtual size: 8B

.rdata Size: 512B - Virtual size: 24B

.reloc Size: - Virtual size: 2KB

.rsrc Size: 33KB - Virtual size: 32KB

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

42:7e:49:a2:96:36:01:02:b9:3c:b0:a4
Certificate

0c:a7:cf:5d:07:07:24:ac:89:e7:9a:3a
Certificate

04:00:00:00:00:01:31:89:c6:50:04
Certificate

3e:be:f6:49:df:b2:3c:ff:63:d8:ef:30:92:b7:e5:43:35:10:d2:da
Signer

31/12/2020, 12:01
Valid: true

CODE
Size: 41KB - Virtual size: 40KB

DATA
Size: 1024B - Virtual size: 592B

BSS
Size: - Virtual size: 3KB

.idata
Size: 2KB - Virtual size: 2KB

.tls
Size: - Virtual size: 8B

.rdata
Size: 512B - Virtual size: 24B

.reloc
Size: - Virtual size: 2KB

.rsrc
Size: 33KB - Virtual size: 32KB